METHOD AND COMMUNICATION SYSTEM FOR CONTROLLING SECURITY ASSOCIATION LIFETIME

Description

BACKGROUND OF THE INVENTION

TECHNICAL FIELD

[0001] This invention relates to selecting a Security Association (SA) timer between user equipment (UE) and a control entity in a communication system and in a preferred application selecting a SA timer for IPSec SA between the UE and a proxy call state control function (P-CSCF) in a 3G communications environment.

BACKGROUND ART

[0002] Fig. 1 illustrates a block diagram of a successful set up of SAs as set forth in Section 7.2 of 3GPP TS 33.203 V5.3.0 (2002-03).

[0003] In the packet switched domain, service is not provided until a SA is established between the UE and the communication system 10 such as the P-CSCF. An IP Multimedia Core Network Subsystem (IMS) is essentially an overlay to the packet switched domain and has a low dependency on the packet switched domain. Consequently, a separate SA is required between a multimedia UE (client) and the IMS before access is granted to multimedia services.

[0004] The SA set up procedure is necessary in order to decide what security services to apply and when the security services are to start in the IMS. In the IMS, authentication of users is performed during registration as specified in section 6.1 of the aforementioned 3GPP publication. Subsequent signalling communications in a session are integrity protected based on keys derived during the authentication process.

[0005] For protecting IMS signalling between the UE and the P-CSCF, it is necessary to agree on shared keys that are provided by the IMS Authentication and Key Agreement (AKA) protocol and a set of parameters specific to a protection method. The security mode set up as described below with reference to Fig. 1 is used to negotiate the SA parameters required for authentication, but without confidentiality. Section 7.1 of the aforementioned 3GPP publication describes the SA parameters.

[0006] Fig. 1 illustrates the normal case of setup of SAs using SIP protocol messages when failure does not occur. Some of the nodes and messages in a typical SIP architecture, which are not directly related to the set up of a SA, have been omitted. Accordingly, there are gaps in the numbering of messages and the Interrogating Call State Control Function (I-CSCF) has been omitted. The UE sends a SM1 REGISTER message to the P-CSCF and towards the Serving Call State Control Function (S-CSCF) to register the location of the UE and to set up the security mode. In order to start the security mode set-up procedure, the UE includes a security set-up line in the SM1 REGISTER message. The security set-up line in SM1 contains the Service Provisioning Infrastructure (SPI) numbers, the protected port selected by the UE and a list of identifiers for the integrity algorithms which the UE supports. Upon receipt of the SM1 REGISTER message by the P-CSCF, the P-CSCF temporarily stores the parameters received in the security set-up line together with the UE's IP address from the source IP address of the IP packet header, the IP multimedia IM Private Identity (IMPI) and the IM Public Identity (IMPU). The P-CSCF sends a SM2 REGISTER message to the S-CSCF. Upon receipt by the P-CSCF of a SM4 4xx Auth_Challenge message originated from the S-CSCF in response to the SM2 REGISTER message, the P-CSCF adds the key IK_IM received from the S-CSCF to the temporary stored parameters. The P-CSCF then selects the SPI for the inbound SA. The P-CSCF defines the SPIs such that they are unique and different from any SPI_S received in the security-set-up line of the UE. This role is needed since the UE and the P-CSCF use the same key for inbound and outbound traffic. In order to determine the integrity of the algorithm, the P-CSCF proceeds such that the P-CSCF has a list of integrity algorithms that the P-CSCF supports, ordered by priority. The P-CSCF selects the first integrity algorithm on its own which is also supported by the UE. The P-CSCF then establishes another pair of SAs in the local security association data base. The security set-up line in the SM6 message contains the SPI assigned by the P-CSCF and a fixed number of the protected port at the P-CSCF. The SM6 message also contains a list of identifiers for the integrity algorithms which the P-CSCF supports. Upon receipt of the SM6 message, the UE determines the integrity algorithm so that UE selects the first integrity algorithm on the list received from the P-CSCF in the SM6 message which is also supported by the UE. The UE then proceeds to establish another pair of SAs. The UE integrity protects the SM7 message and all the following SIP messages. The list of integrity algorithms received in SM6 message are included. After receiving the SM7 message from the UE, the P-CSCF checks whether the integrity algorithm list received in the SM7 message is identical with the integrity algorithms list in the SM6 message. If this is not the case, the registration procedure is aborted. The P-CSCF includes in the SM8 message information for the S-CSCF that the received message from the UE was integrity protected. The P-CSCF adds this information to all subsequent registration messages received from the UE that have successfully passed the integrity check in the P-CSCF. The S-CSCF sends a SM10 2xx Auth_Ok message to the P-CSCF. The P-CSCF sends a SM12 2xx Auth_Ok message to the UE. The SM12 message does not contain information specific to security mode setup (i.e., a security-set-up line). However, when the SM12 message does not indicate any error, the P-CSCF confirms that security mode setup has been successful. After receiving the SM12 message not indicating any error, the UE assumes successful completion of the security-mode set-up.

[0007] Every registration message that includes a user authentication attempt produces new SAs. If the authentication attempt is successful, then these new SAs replace previous ones. If the UE has an already active SA, then the UE uses this to protect the registration message. IF the S-CSCF is notified by the P-CSCF that the registration message from the UE was integrity protected, the S-CSCF may decide not to authenticate the user by means of the AKA protocol. However, the UE may send unprotected registration messages at any time. In this case, the S-CSCF authenticates the user by means of the AKA protocol. In particular, if the UE has an indication that the SA is no longer active at P-CSCF side, the UE sends an unprotected registration message. SAs may be unidirectional or bidirectional. For IP layer SAs, the lifetime is held at the application layer.

[0008] Furthermore, deleting a SA means deleting the SA from both the application and the IPsec layer.

[0009] A UE is involved in only one registration procedure at a time. The UE removes any data relating to any previous incomplete registrations or authentications, including SAs created by an incomplete authentication. The UE may start a registration procedure with an existing pair of SAs. These SAs are referred to as an old SAs. The authentication produces a pair of new SAs. These new SAs shall not be used to protect non-authentication traffic until noted during the authentication of flow. In the same way, certain message in the authentication are protected with a particular SA. If the UE receives a message protected with incorrect SA, it shall discard the message.

[0010] RFC 3261, which essentially corresponds to draft-ietf-sip-rfc2543bis-09, describes the SIP protocol. As described in Section 10.3 therein, when a UE sends a REGISTER message, a registrant, which may be the P-CSCF, processes the request. The REGISTER message has a Contact address and Contact header field for each address.

[0011] The determination of the expiration time of registration of a UE is as follows:

(1) if the field value has an expires parameter, that value must be used.

(2) If there is no such parameter, but the request has an Expires header field, that value must be used.

(3) If there is neither, a locally configured default value must be used. The registrant may shorten the expiration interval.

[0012] With the SIP protocol, the so-called "non-INVITE transaction timeout timer" is 32 seconds. This timer is used as a temporary timer when sending the SM4 and SM6 messages as described above. The UE has 30 seconds to send the SM7 REGISTER message, containing the response to the SM6 4xx Auth_Challenge message by the network. When the authentication challenge in the SM6 message is answered in time with SM7 and SM8 REGISTER messages and the result is verified by the network, a SIP 200 Ok response is sent to the UE with messages SM10 and SM12 described above. The 200 Ok message contains an Expires header or a Contact field described above that indicates the time length of the registration of the UE with the control entity.

[0013] In the prior art, the SA timer can be set rather long, which results in network inefficiency in database management and the chance for UE to flood attack the P-CSCF with messages that require an appropriate response. If the UE does not have a SA with the network, such messages do not reach the P-CSCF which is preferred by the network operators because of more efficient use of resources.

[0014] In 3G communication systems, the UE has to register and re-register from time to time. When a re-registration is not requested within a specified time, subscriber data is deleted from the network elements responsible for handling the communications to and from the UE, such as the P-CSCF. Therefore, a registration timer is maintained in the UE to determine when re-registration is appropriate.

SUMMARY OF INVENTION

[0015] According to various aspects of the present invention, there is provided a method having the features of claim 1, an apparatus having the features of claim 6, a method having the features of claim 11 and an apparatus having the features of claim 12. Advantageous embodiments thereof are defined in the respective dependent claims.

[0016] The present invention comprises a method for selecting a time length of a SA (s) between a UE which transmits and receives communications and a control entity in a communication system and a communication system in which the lifetime of a SA(s) is set with sufficient time to allow completion of the registration. This goal is accomplished with the invention by setting the lifetime of each new SA(s) equal to the time duration of the registration timer which determines the time limit a registration of a UE is invalid. The SA(s) may be set for bidirectional communications between the UE and the control entity of the communication system. In a preferred embodiment, the control entity is the P-CSCF. Also, in accordance with a preferred embodiment of the invention, an old SA is continued for one more interval than when deletion should occur when a new SA is set with a time duration equal to the registration times.

[0017] In accordance with a preferred embodiment of the invention using the SIP protocol, the SM1 REGISTER message is sent by the UE to register the UE with the IMS at the P-CSCF. If the SM1 message is protected, it is protected with an old outbound SA. The UE receives an authentication challenge in a SM6 message from the P-CSCF which is protected with the old outbound SA if the SM1 message was protected and is unprotected otherwise. If the SM6 message can be successfully processed by the UE, the UE creates at least one new SA, which is derived in accordance with the security association parameters of Section 7.1 of the 3GPP TS 33.203 V. 5.3.0 (2002-09). The lifetime of each new SA(s) created at this time is set to allow enough time to complete the registration procedure. The UE sends a SM7 message before expiration of a temporary timer value sent in the SM4 and SM6 messages to the P-CSCF which is protected with the new outbound SA. The P-CSCF sends a SM8 message to the S-CSCF. If the SM1 message was protected, the new SAs can now be used to protect messages other than those in the authentication. Furthermore, for outbound traffic, the new SA is used. The S-CSCF sends a SM10 message to the P-CSCF which uses the registration timer value contained in the Expires or Contact header to set the time duration of the new SA in the P-CSCF. The UE receives the SM12 message from the P-CSCF indicating successful authentication from the P-CSCF which is protected with the new outbound SA. The UE uses the registration time value contained in the Expires or Contact header to set the time duration of the new SA therein. After the successful processing of the message by the UE, registration is complete. The old SAs are now deleted or optionally may be retained for one more interval and the new SAs are used to protect all messages and have a time duration equal to a time length of the registration timer value contained in the SM10 and SM12 messages.

[0018] The present invention eliminates the problems of the prior art by eliminating the flooding of the P-CSCF with messages when the time duration of new SA(s), was not set to have any particular time length with respect to the registration timer and had a time duration longer than the registration timer for the UE to register with the control entity of the communication system. As a result of the invention, the efficiency of the communication system is enhanced in accordance with the present invention.

[0019] A method for selecting a time length of a security association between user equipment which transmits and receives communications and a control entity in a communication system in accordance with the invention includes transmitting a registration message from the user equipment to the control entity requesting registration of the user equipment with the control entity; after transmission of the registration message, setting the time length of the security association between the user equipment and the control entity to be equal to a registration timer length set between the user equipment and the control entity during which registration of the user equipment with the control entity is valid; and transmitting the set time length of the security association to the user equipment as part of an acknowledgment message to the registration message to cause the security association to have a time equal to the registration timer. The control entity may perform a call state control function in the communication system. Communications between the user equipment and the communication system may use the Session Initiated Protocol (SIP) and the registration message may be a SIP REGISTER request message and the acknowledgment message may be a SIP 2xx response message. An authentication challenge may be sent including a temporary timer to the user equipment, preceding the acknowledgment, which sets a time duration for the user equipment to respond to the authentication challenge. A registration message may be sent from the user equipment to the control entity in a response message to the authentication challenge within the set time duration for the user equipment to respond to the authentication challenge. The time duration may be contained in one of an Expires or Contact header of the SIP protocol. The temporary timer may be a non-INVITE transaction timeout timer of the SIP protocol.

[0020] A communication system in accordance with the invention including a user equipment which transmits and receives communications and a control entity which provides control functions in the communication system, and wherein a registration message is transmitted from the user equipment to the control entity requesting registration of the user equipment with the control entity; after transmission of the registration message, the time length of the security association between the user equipment and the control entity is set to be equal to a time length of a registration timer set between the user equipment and the control entity during which registration of the user equipment with the control entity is valid; and the set time length of the security association is transmitted from the control entity to the user equipment as an acknowledgment message to the registration message to cause the security association to have a time duration equal to the registration timer. The control entity may perform a call state control function in the communication system. Communications between the user equipment and the communication system may use the Session Initiated Protocol (SIP) and the registration message may be a SIP REGISTER request message and the acknowledgment message may be a SIP 2xx response message. An authentication challenge may be sent including a temporary timer to the user equipment, preceding the acknowledgment, which sets a time duration for the user equipment to respond to the authentication challenge. A registration message may be sent from the user equipment to the control entity in a response message to the authentication challenge within the set time duration for the user equipment to respond to the authentication challenge. The time duration may be contained in one of an Expires or Contact header of the SIP protocol. The temporary timer may be a non-INVITE transaction timeout timer of the SIP protocol.

BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Fig. 1 illustrates the prior art registration of a UE in a communication system using the SIP protocol including P-CSCF and S-CSCF control entities therein.

[0022] Fig. 2 illustrates a method of setting the time duration of a new SA(s) to be equal to the registration timer controlling registration of a UE as in the prior art system of Fig. 1.

[0023] Like parts are identified identically in Figs. 1 and 2.

BEST MODE FOR CARRYING OUT THE INVENTION

[0024] A communication system and a method which sets the SA(s) to have a timer duration equal to the registration timer defining when registration of a UE is valid in accordance with the invention is described in conjunction with Fig. 2. While the invention has been described with reference to the SIP protocol, it should be understood that the invention is not limited thereto.

[0025] The first step in Fig. 2 is that the UE sends a registration message to a communication system control entity requesting registration of the UE. The control entity in a preferred embodiment is a P-CSCF and the registration message is the SM1 SIP REGISTER message transmitted to the P-CSCF in accordance with the prior art. The P-CSCF forwards the registration message, which preferably is the SM2 SIP REGISTER message, to the S-CSCF. The S-CSCF sends an authentication challenge message which preferably is the SIP SM4 message 4xx AUTH_Challenge message to the P-CSCF. The P-CSCF sends an authentication challenge message, which is preferably the SIP protocol SM6 4xx AUTH_Challenge, to the UE. The SM4 and SM6 authentication challenge messages include a temporary timer setting a time limit for the UE to transmit registration message, which preferably is the SM7 REGISTER message of the SIP protocol, in response to the authentication challenge message SM6. In one embodiment of the invention, the temporary timer value is set equal to 32 seconds, which is the non-INVITE transaction timeout timer of the SIP protocol. The P-CSCF determines by processing the SM7 message if the UE has responded within the temporary timer value. If the temporary timer expires, the registration process and the setting of SA is aborted. The P-CSCF then sends a register message, which is preferably the SIP protocol SM8 REGISTER message, to the S-CSCF. The S-CSCF sets the time length of its SA for the P_CSCF equal to the registration timer limit contained in the SM8 message. The set time limit for the SA, which is equal to the registration timer, is sent as part of the SM10 message to the P-CSCF and then from the P-CSCF as the SM12 message to the UE. When the invention is practiced with the SIP protocol, the Expires or Contact Fields may be used to contains the set timer limit for the new SA(s). The P-CSCF also sets its SA time interval to be equal to the registration timer interval. The P-CSCF forwards the set value of its SA timer, which is equal to the registration timer, to the UE. The UE sets the time limit for its SA for communications with the P-CSCF to be equal to a registration timer length set by the UE defining when registration of the UE with the control entity is valid. The time length of the SAs is for bidirectionally communications between the P-CSCF and the UE. The invention is not limited to the SA time limit being sent by the SM10 and SM12 messages and is not limited to using the Expires and Contact headers to transmit the SA time limit to the P-CSCF and the UE. The time limit is preferably transmitted as part of the acknowledgment message which, in a preferred embodiment, is the SM10 and SM12 messages of the SIP protocol, which are responsive to the SM8 registration message received by the S-CSCF. Setting of the one or more SAs equal to the time length of the registration timer between the UE and the P-CSCF ensures that the problem of the prior art of flooding the P-CSCF with messages is eliminated as described above.

[0026] While the present invention has been described in terms of its preferred embodiments, it should be understood that numerous modifications may be made thereto without departing from the scope of the present invention as defined by the appended claims. It is intended that all such modifications fall within the scope of the appended claims.

Claims

1. A method, comprising:

receiving a registration message from a user equipment, wherein the registration message is for requesting registration of the user equipment with a control entity in a communication system;

after receiving the registration message, setting a time length of a security association between the user equipment and the control entity to be equal to a registration time length set for a registration of the user equipment with the control entity;

in response to the registration message, transmitting an authentication challenge comprising a temporary timer to the user equipment, preceding an acknowledgment message, which sets a time duration for the user equipment to respond to the authentication challenge,

receiving a response message from the user equipment and determining if the user equipment has responded within the set time duration for the user equipment to respond to the authentication challenge, and

if the user equipment has responded within the set time duration, transmitting the set time length of the security association to the user equipment as part of the acknowledgment message to the registration message to cause the security association to have a time length equal to the registration time length;

wherein communications between the user equipment and the communication system are configured to use a session initiation protocol, and

wherein the registration message comprises a session initiation protocol register request message and the acknowledgment message comprises a session initiation protocol response message.

2. A method in accordance with claim 1, further comprising:

performing a call state control function in the communication system.

3. A method in accordance with claim 1 or 2 wherein:

the session initiation protocol response message is a 200 Auth_Ok message.

4. A method in accordance with any one of claims 1 to 3, wherein:

the time duration is contained in one of an expires or contact header of the session initiation protocol.

5. A method in accordance with any one of claims 1 to 4, wherein:

the temporary timer is a non-invite transaction timeout timer of the session initiation protocol.

6. An apparatus, comprising:

receiving means for receiving a registration message from a user equipment, wherein the registration message is for requesting registration of the user equipment with the apparatus;

setting means for setting, after receiving the registration message, a time length of a security association between the user equipment and the apparatus to be equal to a time length of a registration time length set for a registration of the user equipment with the apparatus; and

transmitting means for transmitting the set time length of the security association to the user equipment as part of an acknowledgment message to the registration message to cause the security association to have a time length equal to the registration time length, and for transmitting an authentication challenge comprising a temporary timer to the user equipment, preceding the acknowledgment message, which sets a time duration for the user equipment to respond to the authentication challenge,

wherein communications between the user equipment and the apparatus are configured to use a session initiation protocol,

wherein the registration message comprises a session initiation protocol register request message and the acknowledgment message comprises a session initiation protocol response message,

wherein the receiving means is further for receiving a response message from the user equipment within the set time duration for the user equipment to respond to the authentication challenge,

wherein the apparatus is configured to determine if the user equipment has responded within the set time duration for the user equipment to respond to the authentication challenge, and to transmit the acknowledgement message if the user equipment has responded within the set time duration.

7. An apparatus in accordance with claim 6, wherein:

the apparatus is configured to perform a call state control function in a communication system.

8. An apparatus in accordance with claim 6 or claim 7, wherein:

the session initiation protocol response message is a 200 Auth_Ok message.

9. An apparatus in accordance with any one of claims 6 to 8, wherein:

the time duration is contained in one of an expires or contact header of the session initiation protocol.

10. An apparatus in accordance with any one of claims 6 to 9, wherein:

the temporary timer is a non-invite transaction timeout timer of the session initiation protocol.

11. A method, comprising:

transmitting a registration message to a control entity in a communication system, wherein the registration message is for requesting registration of a user equipment with the control entity;

receiving, in response to the registration message, an authentication challenge comprising a temporary timer from the control entity, preceding an acknowledgment message, which sets a time duration for the user equipment to respond to the authentication challenge,

transmitting a response message within the time duration;

receiving, from the control entity, a set time length of a security association between the user equipment and the control entity as part of the acknowledgment message to the registration message to cause the security association to have a time length equal to a registration time length set for a registration of the user equipment with the control entity; and

after receiving the acknowledgment message, setting the set time length of the security association to be equal to the registration time length set for a registration of the user equipment with the control entity;

wherein communications between the user equipment and the communication system are configured to use a session initiation protocol, and

wherein the registration message comprises a session initiation protocol register request message and the acknowledgment message comprises a session initiation protocol response message.

12. An apparatus, comprising:

transmitting means for transmitting a registration message to a control entity in a communication system, wherein the registration message is for requesting registration of the apparatus with the control entity; wherein the transmitting means are further for transmitting within a time duration a response message to the control entity in response to an authentication challenge from the control entity;

receiving means for receiving, from the control entity, a set time length of a security association between the apparatus and the control entity as part of an acknowledgment message to the registration message to cause the security association to have a time length equal to a registration time length set for a registration of the user equipment with the control entity, and for receiving, in response to the registration message, the authentication challenge comprising a temporary timer from the control entity, preceding the acknowledgment message, which sets the time duration for the user equipment to respond to the authentication challenge; and

after receiving the acknowledgment message, setting the set time length of the security association to be equal to the registration time length set for the registration of the apparatus with the control entity,

wherein communications between the apparatus and the communication system are configured to use a session initiation protocol, and

wherein the registration message comprises a session initiation protocol register request message and the acknowledgment message comprises a session initiation protocol response message.

Ansprüche

1. Verfahren, aufweisend:

Empfangen einer Registrierungsnachricht von einem Benutzergerät, wobei die Registrierungsnachricht zum Anfordern einer Registrierung des Benutzergeräts mit einer Steuerentität in einem Kommunikationssystem dient;

nach Empfang der Registrierungsnachricht, Festlegen eines Zeitraums einer Sicherheitsverknüpfung zwischen dem Benutzergerät und der Steuerentität,

sodass er einem Registrierungszeitraum, der für eine Registrierung des Benutzergeräts mit der Steuerentität festgelegt ist, entspricht;

als Reaktion auf die Registrierungsnachricht, Senden einer der Bestätigungsnachricht vorangehenden Authentifizierungsaufforderung an das Benutzergerät, die einen temporären Timer aufweist,

welcher für das Benutzergerät einen Zeitraum zum Antworten auf die Authentifizierungsaufforderung festlegt,

Empfangen einer Antwortnachricht von dem Benutzergerät und Ermitteln, ob das Benutzergerät innerhalb des Zeitraums, der für das Benutzergerät zum Antworten auf die Authentifizierungsaufforderung festgelegt ist,

geantwortet hat, und

wenn das Benutzergerät innerhalb des festgelegten Zeitraums geantwortet hat, Übermitteln der festgelegten Zeitdauer der Sicherheitsverknüpfung als Teil der Bestätigungsnachricht auf die Registrierungsnachricht an das Benutzergerät, um zu bewirken, dass die Sicherheitsverknüpfung eine Zeitdauer aufweist, die der Registrierungszeitdauer entspricht;

wobei Kommunikationsvorgänge zwischen dem Benutzergerät und dem Kommunikationssystem konfiguriert sind, ein Session Initiation Protocol zu verwenden, und

wobei die Registrierungsnachricht eine Session-Initiation-Protocol-Register-Anforderungsnachricht aufweist und die Bestätigungsnachricht eine Antwortnachricht des Session Initiation Protocol aufweist.

2. Verfahren nach Anspruch 1, das ferner aufweist:

Durchführen einer Rufzustandssteuerfunktion im Kommunikationssystem.

3. Verfahren nach Anspruch 1 oder 2, wobei:

die Antwortnachricht des Session Initiation Protocol eine 200 Auth_Ok-Nachricht ist.

4. Verfahren nach einem der Ansprüche 1 bis 3, wobei:

der Zeitraum in einem von einem Expire- oder

Contact-Header des Session Initiation Protocol enthalten ist.

5. Verfahren nach einem der Ansprüche 1 bis 4, wobei:

der temporäre Timer ein Non-Invitive-Transaction-Timeout-Timer des Session Initiation Protocol ist.

6. Vorrichtung, aufweisend:

Empfangsmittel zum Empfangen einer Registrierungsnachricht von einem Benutzergerät,

wobei die Registrierungsnachricht zum Anfordern einer Registrierung des Benutzergeräts mit der Vorrichtung dient;

Einstellmittel, um nach Empfang der Registrierungsnachricht eine Zeitdauer einer Sicherheitsverknüpfung zwischen dem Benutzergerät und der Vorrichtung festzulegen, sodass sie einer Registrierungszeitdauer, die für eine Registrierung des Benutzergeräts mit der Vorrichtung festgelegt ist, entspricht; und

Übertragungsmittel zum Übertragen der festgelegten Zeitdauer der Sicherheitsverknüpfung als Teil einer Bestätigungsnachricht auf die Registrierungsnachricht an das Benutzergerät, um zu bewirken, dass die Sicherheitsverknüpfung eine Zeitdauer aufweist, die der Registrierungszeitdauer entspricht, und zum Übertragen einer der Bestätigungsnachricht vorangehenden Authentifizierungsaufforderung an das Benutzergerät, die einen temporären Timer aufweist,

welcher einen Zeitraum festlegt, in dem das Benutzergerät auf die Authentifizierungsabfrage antwortet,

wobei Kommunikationsvorgänge zwischen dem Benutzergerät und der Vorrichtung konfiguriert sind, ein Session Initiation Protocol zu verwenden, wobei die Registrierungsnachricht eine Session-Initiation-Protocol-Register-Anforderungsnachricht aufweist und die Bestätigungsnachricht eine Antwortnachricht des Session Initiation Protocol aufweist,

wobei das Empfangsmittel ferner zum Empfangen einer Antwortnachricht von dem Benutzergerät innerhalb des Zeitraums, der für das Benutzergerät festgelegt ist,

um auf die Authentifizierungsaufforderung zu reagieren, ausgelegt ist,

wobei die Vorrichtung konfiguriert ist, zu ermitteln, ob das Benutzergerät innerhalb des Zeitraums, der für das Benutzergerät zum Antworten auf die Authentifizierungsaufforderung festgelegt ist, geantwortet hat, und um die Bestätigungsnachricht zu übermitteln, wenn das Benutzergerät innerhalb des festgelegten Zeitraums geantwortet hat.

7. Vorrichtung nach Anspruch 6, wobei:

die Vorrichtung konfiguriert ist, eine Rufzustandssteuerfunktion in einem Kommunikationssystem durchzuführen.

8. Vorrichtung nach Anspruch 6 oder Anspruch 7, wobei:

die Antwortnachricht des Session Initiation Protocol eine 200 Auth_Ok-Nachricht ist.

9. Vorrichtung nach einem der Ansprüche 6 bis 8, wobei:

der Zeitraum in einem von einem Expire- oder Contact-Header des Session Initiation Protocol enthalten ist.

10. Vorrichtung nach einem der Ansprüche 6 bis 9, wobei:

der temporäre Timer ein Non-invitive-Transaction-Timeout-Timer des Session Initiation Protocol ist.

11. Verfahren, aufweisend:

Übertragen einer Registrierungsnachricht an eine Steuerentität in einem Kommunikationssystem, wobei die Registrierungsnachricht zum Anfordern einer Registrierung eines Benutzergeräts mit der Steuerentität dient;

als Reaktion auf die Registrierungsnachricht, Empfangen einer Authentifizierungsaufforderung, die einer Bestätigungsnachricht vorangeht, die einen temporären Timer von der Steuerentität aufweist, welcher für das Benutzergerät einen Zeitraum zum Antworten auf die Authentifizierungsaufforderung festlegt,

Übertragen einer Antwortnachricht innerhalb des Zeitraums;

Empfangen einer festgelegten Zeitdauer einer Sicherheitsverknüpfung zwischen dem Benutzergerät und der Steuerentität als Teil der Bestätigungsnachricht auf die Registrierungsnachricht, von der Steuerentität, um zu bewirken, dass die Sicherheitsverknüpfung eine Zeitdauer aufweist, die einer Zeitdauer einer Registrierung entspricht, die für eine Registrierung des Benutzergeräts mit der Steuerentität festgelegt ist; und

nach Empfang der Bestätigungsnachricht, Festlegen, dass die festgelegte Zeitdauer der Sicherheitsverknüpfung der Zeitdauer der Registrierung, die für eine Registrierung des Benutzergeräts mit der Steuerentität festgelegt ist, entspricht; wobei Kommunikationsvorgänge zwischen dem Benutzergerät und dem Kommunikationssystem konfiguriert sind, ein Session Initiation Protocol zu verwenden, und

wobei die Registrierungsnachricht eine Session-Initiation-Protocol-Register-Anforderungsnachricht aufweist und die Bestätigungsnachricht eine Antwortnachricht des Session Initiation Protocol aufweist.

12. Vorrichtung, aufweisend:

Übertragungsmittel zum Übertragen einer Registrierungsnachricht an eine Steuerentität in einem Kommunikationssystem, wobei die Registrierungsnachricht zur Registrierungsanfrage der Vorrichtung mit der Steuerentität dient; wobei die Übertragungsmittel ferner zum Übertragen einer Antwortnachricht an die Steuerentität als Reaktion auf eine Authentifizierungsaufforderung von der Steuerentität innerhalb eines Zeitraums dienen;

Empfangsmittel zum Empfangen einer festgelegten Zeitdauer einer Sicherheitsverknüpfung zwischen der Vorrichtung und der Steuerentität als Teil einer Bestätigungsnachricht auf die Registrierungsnachricht von der Steuerentität, um zu bewirken, dass die Sicherheitsverknüpfung eine Zeitdauer aufweist, die einer Zeitdauer der Registrierung entspricht, die für eine Registrierung des Benutzergeräts mit der Steuerentität festgelegt ist, und um als Reaktion auf die Registrierungsnachricht, die der Bestätigungsnachricht vorangehende Authentifizierungsaufforderung von der Steuerentität zu empfangen, die einen temporären Timer aufweist, welcher den Zeitraum festlegt, in dem das Benutzergerät auf die Authentifizierungsaufforderung antwortet; und

nach Empfang der Bestätigungsnachricht, Festlegen, dass die festgelegte Zeitdauer der Sicherheitsverknüpfung der Zeitdauer der Registrierung, die für die Registrierung der Vorrichtung mit der Steuerentität festgelegt ist, entspricht,

wobei Kommunikationsvorgänge zwischen der Vorrichtung und dem Kommunikationssystem konfiguriert sind, ein Session Initiation Protocol zu verwenden, und

wobei die Registrierungsnachricht eine Session-Initiation-Protocol-Register-Anforderungsnachricht aufweist und die Bestätigungsnachricht eine Antwortnachricht eines Session Initiation Protocol aufweist.

Revendications

1. Procédé consistant à :

recevoir un message d'enregistrement en provenance d'un équipement d'utilisateur, le message d'enregistrement servant à demander l'enregistrement de l'équipement d'utilisateur auprès d'une entité de contrôle dans un système de communication ;

après la réception du message d'enregistrement, régler une durée d'une association de sécurité entre l'équipement d'utilisateur et l'entité de contrôle de sorte qu'elle soit égale à une durée d'enregistrement réglée pour un enregistrement de l'équipement d'utilisateur auprès de l'entité de contrôle ;

en réponse au message d'enregistrement, transmettre à l'équipement d'utilisateur, avant un message de validation, un défi d'authentification comprenant un temporisateur temporaire qui règle un délai pour l'équipement d'utilisateur pour répondre au défi d'authentification ;

recevoir un message de réponse en provenance de l'équipement d'utilisateur et déterminer si l'équipement d'utilisateur a répondu dans le délai réglé pour l'équipement d'utilisateur pour répondre au défi d'authentification ; et

si l'équipement d'utilisateur a répondu dans le délai réglé, transmettre la durée réglée de l'association de sécurité à l'équipement d'utilisateur dans le cadre du message de validation du message d'enregistrement, pour faire en sorte que l'association de sécurité ait une durée égale à la durée d'enregistrement,

des communications entre l'équipement d'utilisateur et le système de communication étant configurées pour utiliser un protocole d'ouverture de session, et

le message d'enregistrement consistant en un message de demande d'enregistrement sur protocole d'ouverture de session, et le message de validation consistant en un message de réponse sur protocole d'ouverture de session.

2. Procédé selon la revendication 1, consistant en outre à :

réaliser une fonction de contrôle d'état d'appel dans le système de communication.

3. Procédé selon la revendication 1 ou 2, dans lequel :

le message de réponse sur protocole d'ouverture de session est un message 200 Auth_Ok.

4. Procédé selon l'une quelconque des revendications 1 à 3, dans lequel :

le délai est contenu dans un en-tête d'expiration ou un en-tête de contact du protocole d'ouverture de session.

5. Procédé selon l'une quelconque des revendications 1 à 4, dans lequel :

le temporisateur temporaire est un temporisateur de dépassement de délai de transaction sans invitation du protocole d'ouverture de session.

6. Appareil, comprenant :

un moyen de réception permettant de recevoir un message d'enregistrement en provenance d'un équipement d'utilisateur, le message d'enregistrement servant à demander l'enregistrement de l'équipement d'utilisateur auprès de l'appareil ;

un moyen de réglage permettant de régler, après la réception du message d'enregistrement, une durée d'une association de sécurité entre l'équipement d'utilisateur et l'appareil de sorte qu'elle soit égale à une durée d'une durée d'enregistrement réglée pour un enregistrement de l'équipement d'utilisateur auprès de l'appareil ; et

un moyen de transmission permettant de transmettre la durée réglée de l'association de sécurité à l'équipement d'utilisateur dans le cadre d'un message de validation du message d'enregistrement, pour faire en sorte que l'association de sécurité ait une durée égale à la durée d'enregistrement, et permettant de transmettre à l'équipement d'utilisateur, avant le message de validation, un défi d'authentification comprenant un temporisateur temporaire qui règle un délai pour l'équipement d'utilisateur pour répondre au défi d'authentification,

des communications entre l'équipement d'utilisateur et l'appareil étant configurées pour utiliser un protocole d'ouverture de session,

le message d'enregistrement consistant en un message de demande d'enregistrement sur protocole d'ouverture de session, et le message de validation consistant en un message de réponse sur protocole d'ouverture de session,

le moyen de réception permettant en outre de recevoir un message de réponse en provenance de l'équipement d'utilisateur dans le délai réglé pour l'équipement d'utilisateur pour répondre au défi d'authentification, et

l'appareil étant conçu pour déterminer si l'équipement d'utilisateur a répondu dans le délai réglé pour l'équipement d'utilisateur pour répondre au défi d'authentification, et pour transmettre le message de validation si l'équipement d'utilisateur a répondu dans le délai réglé.

7. Appareil selon la revendication 6,
l'appareil étant conçu pour réaliser une fonction de contrôle d'état d'appel dans un système de communication.

8. Appareil selon la revendication 6 ou 7, dans lequel :

le message de réponse sur protocole d'ouverture de session est un message 200 Auth_Ok.

9. Appareil selon l'une quelconque des revendications 6 à 8, dans lequel :

le délai est contenu dans un en-tête d'expiration ou un en-tête de contact du protocole d'ouverture de session.

10. Appareil selon l'une quelconque des revendications 6 à 9, dans lequel :

le temporisateur temporaire est un temporisateur de dépassement de délai de transaction sans invitation du protocole d'ouverture de session.

11. Procédé consistant à :

transmettre un message d'enregistrement à une entité de contrôle dans un système de communication, le message d'enregistrement servant à demander l'enregistrement d'un équipement d'utilisateur auprès de l'entité de contrôle ;

recevoir, en réponse au message d'enregistrement, en provenance de l'entité de contrôle, avant un message de validation, un défi d'authentification comprenant un temporisateur temporaire qui règle un délai pour l'équipement d'utilisateur pour répondre au défi d'authentification ;

transmettre un message de réponse dans le délai ;

recevoir, en provenance de l'entité de contrôle, une durée réglée d'une association de sécurité entre l'équipement d'utilisateur et l'entité de contrôle dans le cadre du message de validation du message d'enregistrement, pour faire en sorte que l'association de sécurité ait une durée égale à une durée d'enregistrement réglée pour un enregistrement de l'équipement d'utilisateur auprès de l'entité de contrôle ; et

après la réception du message de validation, régler la durée réglée de l'association de sécurité de sorte qu'elle soit égale à la durée d'enregistrement réglée pour un enregistrement de l'équipement d'utilisateur auprès de l'entité de contrôle,

des communications entre l'équipement d'utilisateur et le système de communication étant configurées pour utiliser un protocole d'ouverture de session, et

le message d'enregistrement consistant en un message de demande d'enregistrement sur protocole d'ouverture de session, et le message de validation consistant en un message de réponse sur protocole d'ouverture de session.

12. Appareil, comprenant :

un moyen de transmission permettant de transmettre un message d'enregistrement à une entité de contrôle dans un système de communication, le message d'enregistrement servant à demander l'enregistrement de l'appareil auprès de l'entité de contrôle ; le moyen de transmission permettant en outre de transmettre, dans un certain délai, un message de réponse à l'entité de contrôle en réponse à un défi d'authentification en provenance de l'entité de contrôle ;

un moyen de réception permettant de recevoir, en provenance de l'entité de contrôle, une durée réglée d'une association de sécurité entre l'appareil et l'entité de contrôle dans le cadre d'un message de validation du message d'enregistrement, pour faire en sorte que l'association de sécurité ait une durée égale à une durée d'enregistrement réglée pour un enregistrement de l'équipement d'utilisateur auprès de l'entité de contrôle, et permettant de recevoir, en réponse au message d'enregistrement, en provenance de l'entité de contrôle, avant le message de validation, le défi d'authentification comprenant un temporisateur temporaire qui règle le délai pour l'équipement d'utilisateur pour répondre au défi d'authentification ; et

après la réception du message de validation, régler la durée réglée de l'association de sécurité de sorte qu'elle soit égale à la durée d'enregistrement réglée pour l'enregistrement de l'appareil auprès de l'entité de contrôle,

des communications entre l'appareil et le système de communication étant configurées pour utiliser un protocole d'ouverture de session, et

le message d'enregistrement consistant en un message de demande d'enregistrement sur protocole d'ouverture de session, et le message de validation consistant en un message de réponse sur protocole d'ouverture de session.

Drawing